Employees should authenticate to Workspace through the organization's supported external identity provider. Which approach best fits?

1. Use an appropriate directory synchronization or automated provisioning tool.
2. Use a suitable group and the setting's supported group-based controls.
3. Place relevant users in an appropriate organizational unit and configure its policy.
4. Configure supported SAML SSO and test the identity mapping.